Code segment and page with R/W?

[amirsadig]

you know we could define a page as R/W, but what happend, when we access this page throw Code Segment and Data Segment descriptor.

I asked this, because when I link my programs without page align ( 4096), it mean may be the end of code and the begin of data segment in the binary in the same page.

for example if we had code segment begin at 0x080482e0 end at 0x08049588, the data segment then begin at 0x08049588 and end at 0x080495a0.
how we should make the best mapping.

this example is a real example from a program run in linux.

[Tim]

I asked this, because when I link my programs without page align ( 4096), it mean may be the end of code and the begin of data segment in the binary in the same page.

So align all sections to page boundaries. There's no other way of getting around this, except by giving each section its own segment (and losing compatibility with HLLs).

[amirsadig]

if I have make a Code and Data Segment Describtor in GDT, which they piont to the same base address, and I have make a page with R and W access, which point to a physical adress, used for code and data. the first 2000 byte is for code and the secont 2096 for data.
when a program tried to write data in the segment, which it use the Data segment selector. I think there is no problem, because it use a data segment descriptor with r&w access, and the page is also has write access. is that right?

[Tim]

If the code and data segments have the same base address then you'll be able to write to the code as if it were data. The only way to fix this would be to put the code and data on separate pages, and apply R/W permissions in the page table, or to put them in distinct segments.

IMO the best way is to page-align each section, code and data. You'll waste a maximum of 4095 bytes, which will be small compared to the size of the overall program.

[amirsadig]

when you want to make OS for User application, you should thing about every things. gcc or others compiler and linker does not make page-align as default and its not good to limited the user for using page-align, and if have a program with a 2000 byte then 2096 is free and others program can not use this free memory.
when you see in any linux program with "objdump" you will see that there is no page-align.

[Tim]

It's the processor that's limiting you to specifying protection attributes on a per-page basis, so restricting the programmer in this manner is acceptable (i.e., "if you don't want your programs page-aligned, choose a different CPU").

I don't know about page alignment of Linux images, but if they're not page-aligned in memory (they aren't necessarily page-aligned on disk -- PE files tend to be sector-aligned on disk) then you will experience broken protection as you mentioned at the start. It's a fact of life with the x86 that you can't apply protection to objects smaller than pages without using segmentation.

[Pype.Clicker]

linux *do* align sections when it loads programs. Just check out what /proc/<your-program-pid>/maps gives out ...

[amirsadig]

that is right.
that mean linux play with the base address in the Segment descriptor, so that the section will be mapped to the geven virtual address.

for example :

Code Segment in ELF Image begin at : 0x8040450 to
0x80402450
we can use virstual address 0x8041000, then base address of Segment descriptor in GDT is :
0x8041000 - 0x8040450 = 0xBB0
Data Segment in ELF Image : 0x8042450 to 0x8043960
next virtual address is 0x8043000 , then base address of Segment descriptor in GDT is :
0x8043000 - 0x8042450 = 0xBB0

note:
but we can use for one task three segment, data , code and stack, that mean I can collect all data section in one segment! or not?

[Pype.Clicker]

linux does *not* play with base address. There is only one huge flat code segment in linux for every user process ...

You should check the "program header" instead of the section headers. Only the program header is relevant for loading binaries, sections are for the linker (check ELF documentations if you doubt

Code: Select all

/bin/ls:     file format elf32-i386
/bin/ls
architecture: i386, flags 0x00000112:
EXEC_P, HAS_SYMS, D_PAGED
start address 0x08049420

Program Header:
    PHDR off    0x34 vaddr 0x08048034 paddr 0x08048034 align 2**2 filesz 0xc0 memsz 0x000000c0 flags r-x
  INTERP off    0xf4 vaddr 0x080480f4 paddr 0x080480f4 align 2**0 filesz 0x00000013 memsz 0x00000013 flags r--
    LOAD off    0x0 vaddr 0x08048000 paddr 0x08048000 align 2**12 filesz 0x0000a960 memsz 0x0000a960 flags r-x
    LOAD off    0x0000a960 vaddr 0x08053960 paddr 0x08053960 align 2**12

If you look at it closely, you can see code (load r-x) is mapped on addresses 0x8048000 .. 8052960, while the next segment is starting at 0x8053960. Clearly shows no page is holding both executable and writable code togehter, so code can be protected against overwriting by making its pages read-only.

Now that protection might not be enough if you also want to prevent the program to build up some instructions in a data-class array and then jumping it (which is the base of most Unix exploits). Therefore, you need to resize the code segment so that the stack and heap aren't executable, which Linux can't do on IA-32 systems...

[amirsadig]

that is right. I have read the wrong information in the elf file, because I have used "objdump -h" and this print the section headers, but after I use "readelf -l " I have read the program header and the is page-align.

Thanks alot.